Skip to content

Standard Reader

ioneyrezende

@ioneyrezende.bsky.social

Security researcher & pentester. I write about network security, web appsec, and breaking things ethically.

0Readers

18Posts

todayLast active

Ivanti Connect Secure: an exploited privilege escalation and a quieter credential path

Ivanti Connect Secure: an exploited privilege escalation and a quieter credential path

securityvulnerability-management

Two SQL Injection Flaws in Zabbix, and Why the API Account Is the Real Perimeter

Two SQL injection flaws in one monitoring platform, one reachable with a non-administrative API account and one through a failed login. What the monitoring plane holds, and the configuration review that recovery does not cover.

zabbixcve-2024-42327

The fast-jwt fix for algorithm confusion missed the prefix

CVE-2026-107722 reopens RSA to HS256 algorithm confusion in fast-jwt 6.2.x because PEM detection trims whitespace while the header matcher stays start-anchored.

jwtauthentication

SkyWalking answers 7,586 titles on 8080 and almost nothing on 12800

SkyWalking returns 7,586 title matches but nothing on port 12800, showing how port assumptions and authentication layers change what an external index can see of an observability stack.

The Plex patch cluster: why one CVE is not the whole story

The Plex patch cluster: why one CVE is not the whole story

vulnerabilityCVE-2026-96655

PHP2Shell: what 884,000 unpatched hosts mean for the PHP runtime you forgot you were running

securitycybersecurity_article

Same week, same interpreter: CVE-2026-109618 and the two-defect PHP release

phpremote code execution

Eight Intermediates and a Key That Was Just a Number: What the eMudhra CA Compromise Means for Non-Browser Clients

Eight eMudhra intermediates were revoked within three days. Browsers were covered; curl, Python, Node, Go and frozen firmware were not. A trust store inventory that actually finds the risk.

pkicertificate-authority

FortiSIEM and port 27918: what an open port does and does not tell you

securityzoomeye_article

Third VeloCloud Orchestrator Flaw Exploited in 2026: CVE-2026-114625 in a Pattern

CVE-2026-114625 is the third exploited VeloCloud Orchestrator flaw in 2026. What changed with the authentication requirement, and what the pattern says about patch assurance.

trend-analysissd-wan

Headscale: 85 title matches against 18 on 443 and 7 certificate hits

Headscale returns 85 title matches, 18 on 443 and seven certificate hints, a small population where each query measures a different disclosure.

zoomeyemesh-network

A Stolen Configuration Is Not an Exploit, and That Is the Problem

Why stolen FortiGate configuration and credential material survives patching, and how to sequence rotation after a management-plane compromise.

Fortinetcredential rotation